How to prevent IP Spoofing Attacks

[don]

I help secure a network of thousands of users country wide actually. Most of the attempted
hacks we see are of the nowadays cheesy variety. There will always be easy hacks as it were
for the kiddie out there as long as ISP's do not force users to prove possession of a f/w and
a/v software. These people however are quickly becoming the minority. Thankfully!
For the true hacker/programmer there will always be new hacks because they are actually
putting some thought and effort into it. Later dude.

[Tiger Shark]

Originally posted here by don
Most of the attempted hacks we see are of the nowadays cheesy variety.

But you are looking at it from a security specialists point of view with specific regard to securing a corporate network. That is all well and good but if you step back a bit I think you will find that your rosy view of the world may taint a little.....

The high speed internet market is pretty cut-throat at the moment. Just about the last thing the players are going to do is to drive away customers by insisting that they purchase a firewall an addition to the perceived higher cost of the high speed service. Furthermore, the free firewalls, (Zonealarm etc.), come with a high cost - that of requiring non computer savvy users to know what to answer when it pops up and asks if proggie X should be allowed to contact the internet - it only takes one wrong click and the firewall just became useless. Most users will click yes to things they don't understand because they realize that clicking no may prevent them from doing something they want to do and they will be unable to undo the "damage" because they perceive the concepts to be too complex for them to understand.

Additionally, the players are not going to institute firewalls themselves because of the added cost of purchase/implimentation and the high overhead of administration. When Joe Blow can't play his online game because it shifts port from the original SYN packet, (some do that), he's gonna call and pitch a bitch fit - the player needs more support personnel and more firewall admins to enable him to play. If they don't cooperate with the user he will go over to the competition who don't firewall him..... He doesn't care that much about his security as long as he can play his game.....

[don]

Granted things are nowhere near where they should be in the wet and wild web. I posted a
thread in another place a while back stating that computer ownership should be no different
then owning a car or gun. You should have to take a course and prove competentcy ie: to
have the aforementioned f/w, a/v and the such.
Why not? A computer is very much a weapon in the right hands. If one is so foolish as to leave
ones computer vulnerable then one should be liable. After all it is not about not caring about
having your coputer rooted but rather what can be done via your computer once it has been.
Hence the creation of standardised (spelling???) testing for the ownership of a pc. It may
sound Orwellian however given the present mindset of most users it could be quite beneficial.

Greetz from the colonies oh Imperial Overlord! :-)
Don

[zip2dip]

IP-Spoofing,Still works on many Networks

I have come accross some software that lets you send String-commands.That alter either the client end or the server end machine.Which will let you either halt thread-process in a Unix or windows machine on any network.IP-spoofing is still a huge threat to any network that has not implemented security meassures against it.Some firewalls that get IP-spoofesd has many security flaws against it depending on the content of the string commands that you can send directly to your server or client processor.Makeing it very vulnerable to the attack.
http://www.8th-wonder.net/ware.asp
Test the program called calamus2.0 just for your enlightment....

[Tiger Shark]

Don: While i like the idea - it ain't never gonna fly...... Jeez, there'd be like 5 users worldwide....

BTW - While I hail from the Great Land I currently live in the Good Ole US af A - Sunny Detroit to be precise.....

[invader]

I wonder where dear Networker is gone,
he really believed that spoofing no longer exists, and is not a danger at all.

[don]

1) I took a look at Calamus a year or so ago and found I could do the same myself minus the
prog. However what is point? The packets will only go back to the spoofed addy. To get the
stimulus back you need to enter your valid addy. You could fire a sheetload of spoofed addy's
in the hope of obfuscating the real attacking one and that is about it.
To an intelligent user who has the proper precautions in place ip spoofing is but a minor irritant and not a real threat.

2) I only wish my Orwellian fantasy were reality!!! :-) Your quite right though. Heh were it to
come true I would put myself out of a job. That would not be good at all.

3) Also so is it just me or is usenet in general starting to such big time? Some of the groups I
participate in are mostly filled with posers and wannabe's. I'm a wannabe too however I really
wannabe in the cargo bay with 7 of 9!!!